Document ec.rebuild -checksum and the ec.decode shard check

EC-Bitrot-Detection.md

@@ -35,6 +35,16 @@ During rebuild, present input shards are verified against the sidecar and corrup
 
 If the sidecar is present but malformed, the rebuild **fails closed** rather than rebuilding without verification — pass `-unsafeIgnoreSidecar` to override. On any verification failure the rebuild removes every file it generated, so it never publishes bytes it could not verify.
 
+`ec.rebuild` only regenerates missing shards by default. With `-checksum` it first verifies every shard against the sidecar, as `ec.scrub -mode checksum` does, and regenerates the shards that fail, even in volumes that still have every shard:
+
+```
+ec.rebuild -checksum -apply
+```
+
+### Decoding back to a normal volume
+
+`ec.decode` verifies every data shard it reads against the sidecar before writing the `.dat`. If a shard fails, or the sidecar is malformed, the decode stops and leaves every shard in place, including the parity that can repair it. Repair the shard with `ec.rebuild -checksum -apply`, then run `ec.decode` again.
+
 ### Backfilling existing volumes
 
 Volumes encoded before this feature have no sidecar. When such a volume is rebuilt on a server that can reach all of its shards, a sidecar is written automatically (trust-on-first-use), so existing volumes become protected over time.